CVE-2026-63728 in Gitleaks
Summary
by MITRE • 07/21/2026
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists in gitleaks versions prior to 8.30.1 and represents a critical template injection flaw that undermines the security of the tool's reporting functionality. The vulnerability stems from the improper handling of user-supplied report templates within the templating engine, specifically exposing non-hermetic Sprig template functions that can execute arbitrary system commands or access sensitive environment variables. The core technical issue lies in how gitleaks processes report templates without adequate sanitization or isolation mechanisms, allowing attackers to inject malicious template code that leverages built-in functions like env, expandenv, and getHostByName.
The operational impact of this vulnerability is severe as it enables attackers with the ability to influence report templates to extract confidential information from the scanning environment. Through the use of the env function, attackers can access all environment variables available to the gitleaks process, potentially retrieving API keys, database credentials, token values, and other sensitive configuration data. The expandenv function further amplifies this risk by allowing attackers to manipulate environment variable expansion in ways that can reveal additional secrets or construct malicious payloads. The getHostByName function presents another vector for information disclosure, as it can be used to perform DNS lookups that may inadvertently leak sensitive data through DNS query content.
This vulnerability aligns with CWE-94, which describes improper control of generation of code, and specifically relates to template injection flaws that occur when user-controllable data is processed through templating engines without proper sanitization. The attack pattern follows ATT&CK technique T1566.002 for initial access through malicious files and T1071.004 for command and control communications via DNS tunneling. The exfiltration mechanism through DNS queries represents a sophisticated approach to data exfiltration that can bypass traditional network monitoring solutions, as DNS traffic often flows unimpeded through firewalls and security appliances.
The risk is particularly elevated because gitleaks is commonly used in CI/CD pipelines and automated scanning environments where it may have access to sensitive credentials and tokens through environment variables or configuration files. Attackers can craft malicious templates that are executed during report generation, effectively turning the reporting functionality into a data exfiltration mechanism. The vulnerability demonstrates how seemingly benign features like customizable reports can become attack vectors when proper input validation and execution isolation are not implemented. Organizations using gitleaks should immediately upgrade to version 8.30.1 or later, which addresses this issue by implementing stricter template validation and removing access to dangerous Sprig functions during report generation.
The remediation approach requires ensuring that all user-supplied template content undergoes rigorous sanitization and that the templating engine operates in a restricted environment where potentially dangerous functions are disabled or isolated from sensitive system resources. Security controls should include input validation for template files, sandboxing of template execution contexts, and monitoring for unusual DNS query patterns that may indicate data exfiltration attempts. Additionally, organizations should implement least-privilege principles for gitleaks execution environments to minimize the potential impact of such vulnerabilities in case they are exploited despite preventive measures.